SG105 failure due to http-proxy resource usage

Hi FFin ,

Thank you for reaching out to the community, have you seen impact with the users apart from the resource utilization going high ?
Can you Sophos UTM: Monitor resource utilization history via atop ?

And apart from that have you seen any coredumps under the directory cd /var/storage/cores ?

Yes, impact is that UTM become inaccessible, offline and network goes down until hardware-reboot onsite.
Some of these are offsite-locations with 1 PCs and usually no web-traffic at all. Or just some background-monitoring and remote-access. Even an SG105 should be able to handle this.

Here coredump-folders of three independent diffrent SG105 customers facing these issues and outages within last 48 hours:

And we have a few more appliances with this within the last weeks....

I fear more outages enabling "atop" on these devices, that will lead to even more resouce usage..

Shall we raise support cases for one or more of these SG105s?

Yes, impact is that UTM become inaccessible, offline and network goes down until hardware-reboot onsite.
Some of these are offsite-locations with 1 PCs and usually no web-traffic at all. Or just some background-monitoring and remote-access. Even an SG105 should be able to handle this.

Here coredump-folders of three independent diffrent SG105 customers facing these issues and outages within last 48 hours:

And we have a few more appliances with this within the last weeks....

I fear more outages enabling "atop" on these devices, that will lead to even more resouce usage..

Shall we raise support cases for one or more of these SG105s?

Please raise a support service request and share us the case id here, so that we can expedite the reported situation... 

Hi Vivek Jagad , thanks! I've raised Case #07368170.

Thank you will get this expedited...FFin 

Hi FFin ,

Based on the logs, the device is running out of the memory:
2024:05:24-06:56:57 gate-nordoe kernel: [3076892.143099] Out of memory: Kill process 29063 (httpproxy) score 79 or sacrifice child
2024:05:24-06:56:57 gate-nordoe kernel: [3076892.143107] Killed process 29063 (httpproxy) total-vm:669836kB, anon-rss:317440kB, file-rss:0kB
2024:05:24-07:00:48 gate-nordoe kernel: [ 130.416723] hwinfo: vm86 mode not supported on 64 bit kernel

Current utilization stands at 84%

Yes, but why? It‘s not undersized according to sizing guide. WebProtection has been configured since first rollout. And there‘s no usage growth on network within last years.

So why is memory a problem with webfilter just being enabled since a few weeks/month?

On multiple appliances of this size..

Our team will investigate on this and provide you an update on the service request, meanwhile I see there is an update available - UTM Up2date 9.7 MR19 (9.719) released | See if upgrading the appliance helps stabilize the reported situation...

Thank you, the issue persists through the last 3 up2date releases and there‘s nothing about http-Proxy in release notes. So I guess that will not change, but I’ll keep that in mind.

Thank you for the background, will keep you posted on the investigation...

I've compared yearly hardware-usage graph on 4 SG105 appliances (different customers and usage profiles).
Swap usage average and peaks increased since beginning of this year at all four of them:

Looks like some (pattern-)updates(?) causes SG105-appliances no longer being able to make use of WebProtection module at all...

Disabling WebProtection completely (from url filtering only) will immediately drop hardware usage (as expected):

On slightly greater appliances like SG115 you can see swap increase as well around the same time, but here it's not killing the hardware: